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Abstract. Photon number resolving detectors can enhance the performance of many 
practical quantum cryptographic setups. In this paper, we employ a simple method 
to estimate the statistics provided by such a photon number resolving detector using 
only a threshold detector together with a variable attenuator. This idea is similar in 
spirit to that of the decoy state technique, and is specially suited for those scenarios 
where only a few parameters of the photon number statistics of the incoming signals 
have to be estimated. As an illustration of the potential applicability of the method 
in quantum communication protocols, we use it to prove security of an entanglement 
based quantum key distribution scheme with an untrusted source without the need of 
a squash model and by solely using this extra idea. In this sense, this detector decoy 
method can be seen as a different conceptual approach to adapt a single photon security 
proof to its physical, full optical implementation. We show that in this scenario the 
legitimate users can now even discard the double click events from the raw key data 
without compromising the security of the scheme, and we present simulations on the 
performance of the BB84 and the 6-state quantum key distribution protocols. 



1. Introduction 

Among the research performed nowadays in order to increase the secret key rate and 
distance that can be covered by quantum key distribution (QKD) systems, one can 
distinguish three main work areas which are closely related to each other [11 [21 [3] . On 
the one hand, we have the development of new proof techniques, together with better 
classical post-processing protocols, that are able to further extend the proven secure 
regimes for idealized QKD schemes, typically based on the transmission of two-level 
quantum systems (qubits) [l[5l[6l[7l[8l[9l[T0l[IIl[T2l[T3]. On the other hand, we 
find the continuous improvements that come from the technological side. Especially, 
the design of better light sources and better detectors should give us provable secure 
communications over a growing distance [TH [151 [IS] • Finally, we have the research which 
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aims to close the gap between theoretical security concepts for idealized QKD schemes 
and their experimental realization [T7t fT8l fT9| 12011211 [22| [23] . 

The awareness of such a theory-experiment gap was triggered by the important 
deviations present in practical QKD setups with respect to their original theoretical 
proposal, which usually demands technologies that are beyond our present experimental 
capability. Especially, the signal states emitted by the source, instead of being single 
photons, are usually weak coherent pulses which can contain more than one photon 
prepared in the same polarization state. Now, the eavesdropper (Eve) is no longer 
limited by the no-cloning theorem [23], since the multiphoton pulses provide her with 
perfect copies of the single photon. In this scenario, she can perform the so-called photon- 
number splitting attack [25l 126] . This attack gives Eve full information about the part 
of the key generated from the multiphoton signals, without causing any disturbance 
in the signal polarization. The use of weak coherent pulses jeopardizes the security 
of QKD protocols, and lead to limitations of rate and distance that can be achieved 
by these techniques. For instance, it turns out that the BB84 protocol [27] with weak 
coherent pulses can give a key generation rate of order 0{rj^) [20l [21], where rj denotes 
the transmission efficiency of the quantum channel. 

A significant improvement of the secret key rate can be obtained when the hardware 
is slightly modified. In particular, by using the so-called decoy state method [T71 [T8| [T9] . 
In this approach, the sender (Alice) varies, independently and at random, the mean 
photon number of each signal state sent to the receiver (Bob) by employing different 
intensity settings. Eve does not know the mean photon number of each signal sent. 
This means that the gain and the quantum bit error rate (QBER) of each signal can 
only depend on its photon number but not on the particular intensity setting used to 
generate it. From the measurement results corresponding to different intensity settings, 
it turns out that the legitimate users can estimate the gain and the QBER associated 
to each photon number state and, therefore, obtain a better estimation of the behavior 
of the quantum channel. This translates into an enhancement of the resulting secret 
key rate. The decoy state technique has been successfully implemented in several recent 
experiments [161 [2H1 [291 EDI [31], and it can deliver a key generation rate of the same 
order of magnitude like single photon sources, i.e., Oirf) [TTl [T8| 119]. 

The use of photon number resolving (PNR) detectors instead of threshold detectors 
can also enhance the performance of many practical QKD setups. For instance, in those 
situations where the decoy state method cannot be easily applied. This is the case, for 
example, in a QKD scheme with an untrusted source where the legitimate users cannot 
control the mean photon number of the signal states emitted. In these scenarios, it 
might be still very useful for the legitimate users to have access to the photon number 
statistics of the incoming signals. To simplify the security analysis, it is very tempting 
to assume a squash model for Alice's and Bob's detection setup [32]. This model maps 
each incoming signal to a one-photon polarization space followed by a measurement in 
this smaller dimensional Hilbert space. The squash model has been recently proven to 
be correct for the case of the BB84 protocol [331 [M]. However, in Ref. [33] it was shown 
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that the same does not hold, for instance, for the active basis choice measurement in 
the 6-state protocol [35] . 

In this paper, we analyze a simple method to estimate the photon number statistics 
provided by a PNR detector using only a practical threshold detector together with 
a variable attenuator. The basic idea consists in measuring the incoming light field 
with a set of simple threshold detectors with different efficiencies and thus one obtains 
more information about the underlying distribution of the photons. This technique 
has its origin in the field of quantum metrology as discussed in Refs. [36l [371 EH] and 
has been successfully implemented in some recent experiments [39l HQl HI] which show 
the practical feasibility of the method. Here we apply it for the first time to various 
realistic QKD scenarios. For instance, it can be used to prove security of those QKD 
setups that do not have a squash model [34], or in those security proofs that only 
require the statistics given by a PNR detector |12]. However if one likes to employ this 
technique in the QKD context one has to estimate the photon number statistics under 
the worst case assumption for Alice and Bob. Thus the known reconstruction method 
from Refs. [371 [38] which considers only a truncated version of the problem (under the 
additional constraints of only a finite, small number of experimental runs) cannot be 
directly used for the QKD setups. Nevertheless, the central idea of the problem remains 
unchanged. In fact, this method can be considered as the decoy state technique applied 
to the detector side: If Alice and Bob vary, independently and at random, the detection 
efficiency of their apparatus then they can estimate the photon number statistics of 
the signals received. Note that the photon number distribution of the incoming signals 
cannot depend on the particular efficiency setting used to measure them. Therefore, 
from now on, we shall refer to this estimation procedure as detector decoy to emphasize 
its connection and applicability to QKD. The detector decoy idea can be employed both 
for calibrated and uncalibrated devices [3]. The essential requirement here is that Eve 
cannot modify the variable attenuator employed by the legitimate users to vary the 
detection efficiency of their setups. 

Specifically, we apply the detector decoy method to two different QKD scenarios. 
In the first one, we prove the security of an entanglement based QKD scheme with 
an untrusted source solely by using this estimation procedure. More precisely, we 
investigate the situation where Alice and Bob perform either the BB84 or the 6-state 
protocol, and we compare the resulting key rates with those arising from a security proof 
based on the squash model assumption [32]. In contrast to this last scenario, now Alice 
and Bob can now even sift out the double click events without compromising the security 
of the scheme. Note, however, that we compare different situations, since they require 
different detection setups. As a second potential application, we analyze an alternative 
experimental technique, also based on the detector decoy method, to estimate the photon 
number statistics of the output signals in a "Plug & Play" configuration [m, [131 HI] • 

The paper is organized as follows. In Sec. [2] we describe in detail the detector 
decoy idea to estimate the photon number statistics of an optical signal by means of a 
threshold detector combined with a variable attenuator. Next, we apply this method 
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to different practical QKD scenarios. In particular, Sec. [3] analyzes the security of an 
entanglement based QKD scheme with an untrusted source. Then, in Sec. HJwe propose 
an experimental technique to estimate the photon number statistics of the output signals 
in a "Plug & Play" configuration. Finally, Sec. [5] concludes the paper with a summary. 

2. Estimating photon number statistics 

Most of the security proofs for QKD only require the estimation of a few parameters 
related with the photon number statistics of the incoming signals. These parameters 
suffice to obtain good lower bounds for the achievable secret key rate. Here we 
discuss and explain the technique to measure the photon number distribution of an 
optical signal by means of a practical threshold detector in combination with a variable 
attenuator. As mentioned this idea has been introduced previously in the scientific 
literature before, cf . Refs. [361 EH EH] . The current discussion differs in the particular 
way of how one reconstructs part of the photon number distribution from the observed 
measurement outcomes; here we need to provide ultimate bounds for certain photon 
number parameters, cf. Prop. 12. ![ that are valid without any further assumptions on 
the signal states. Of course, the photon number distribution can also be obtained by 
using directly PNR detectors [ISl US] . This approach would provide Alice and Bob not 
only with the distribution of the incoming signals but also with the number of photons 
contained in each of them. Unfortunately, most of the methods proposed so far in 
the literature to construct this type of detectors result in devices with low detection 
efficiencies and which are unable to operate at room-temperatures. An interesting 
alternative is that based on detection schemes which use, for instance, time multiplexing 
techniques [47l |48] . This method has allowed, for example, a passive decoy selection 
in QKD, cf. Ref. [IHl [50]. In this last case, however, the achievable photon number 
resolution depends on the number of detectors and on the number of spatially, or 
temporal, separate bins used. 



Figure 1. Case A) Detection setup wliicli combines a beam splitter of transmittance 
77 together with an ideal threshold detector. The incoming signal state p-m is given 
by Eq. O Case B) If one varies the transmittance rj of the beam splitter, then the 
detection setup given in Case A is equivalent to a quantum non- demolition (QND) 
measurement that provides only the photon number statistics of the incoming signals. 
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The basic idea of the detector decoy technique can be highhghted with a simple 
example. Let the optical signals arriving to a ^jer/eci threshold detector be either a single 
photon pulse or a strong pulse containing several photons. These two signals will always 
produce a single click in the detector. Therefore, in this scenario both events cannot be 
distinguished. Suppose now that a beam splitter with very low transmittance is placed 
before the detector and the same kind of signals is received once more. Then, the single 
photon pulse will produce much less clicks than the strong pulse. In principle, both 
events can now be distinguished. That is, by varying the transmittance of the beam 
splitter more information about the photon number distribution of the signals received 
becomes available. 

Let rj denote the transmittance of such a beam splitter (Case A in Fig. [1]). The 
combined detection setup can be characterized by a positive operator value measure 
(POVM) which contains two elements, F^s^dv) -^ciickl??), given by [5T] 

oo 

FUv) = - ^)"nn, (1) 

n=0 

and -Fciick(?7) = 1 — -FVac, where n„ represents the projector onto the n-photon subspace. 
That is, the outcome of F^^dv) corresponds to no click in the detector, while the operator 
-Pciickl??) gives precisely one detection click, which means at least one photon is detected. 
Suppose for the moment that the input signal state is of the form 

oo 

Pin = ^PnPn, (2) 
n=0 

where the signals pn belong to the n-photon subspace. 

The probability of getting a click, that we shall denote as Pciickl'?), depends on the 
transmittance rj of the beam splitter. It can be calculated as PcUckiv) = tr[Fciick(?7)Pm]- 
Similarly, Pva.c{v) = 1 ~ Pciickl??) represents the probability that the detector does not 
click. Using Eq. [H we find that this last quantity can be expressed as Pvudv) = 
Yl'^=oi^ ~v)"'Pn- Now one can follow a similar idea to that of the decoy state method. In 
particular, if the receiver varies the transmittance rj = {rji, . . . , tjm} of the beam splitter 
he can generate a set of linear equations with the probabilities Pn as the unknown 
parameters [36l [37l [38]. 

oo 

Pvac(^l) = ^(1 -r/l)>„, 
n=0 

; (3) 

oo 

PvAvm) = - VmTPu- 

n=0 

From the observed data Pvaciv)^ together with the knowledge of the transmittance r) 
used, the receiver can solve Eq. [3] and obtain the value of Pn- For instance, in the 
general scenario where he employs an infinity number of possible decoy transmittances 
Tj E [0, 1], he can always estimate any finite number of probabilities Pn with arbitrary 
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precision. This result is illustrated as Case B in Fig. [T] On the other hand, if the 
receiver is only interested in the value of a few probabilities Pn, then he can estimate 
them by means of only a few different decoy transmittances, like in the decoy state 
method [TTl [181 [13 El] • This last statement is given by Proposition 12.11 for the case 
where the receiver only wants to find worst case bounds for the probabilities po, pi, 
and p2- This proposition can straightforwardly be generalized to cover also the case 
of any other finite number of probabilities Pn- Note, however, that it only constitutes 
a possible example of an estimation procedure that provides the exact values of the 
probabilities p„ in the considered limit. In principle, many other estimation techniques 
are also available, like linear programming tools [53] or different ideas from the original 
decoy state method |54j . 

Proposition 2.1. [Finite settings] Consider the set of linear equations given by 

oo 

/(c) = ^c"x., (4) 

n=0 

where the unknown parameters x„ fulfill x„ > and Yl'^=o ^ C for a given constant 
C, and where c satisfies c G [0, 1]. Consider now three different settings cq = 0, ci and 
02- Then, the unknown variables Xq, Xi and X2 satisfy, respectively, Xq = /(cq) = /(O), 

Ci — Ci C\ 

and /2(ci,C2) < X2 < ^42(^1,02) with bounds 

w ^ /(C2) - /(O) (1 - c\) - uM) (C2 - cj) - c\C 

h\C\-,C2) — 2 3 ' 

, . /(c2)-/(0)-C2/l(Ci) 

M2(Cl,C2) = 2 • (') 

^2 



When Ci = A and 02 = v A, the given bounds converge to the exact value of the variables 
Xi and X2 in the limit A — 0. 

Proof. We present the explicit derivation of the upper bound Mi(ci) and of the lower 
bound /2(ci, C2). The other bounds can be obtained in a similar way. The basic idea is 
as follows: We first upper bound Xi from the knowledge of /(ci); afterwards this result 
is used to lower bound X2 given the value of /(C2). Starting with the definition of /(ci) 
we obtain 

00 

/(ci) = xo + cixi + ^ CiX„ > /(O) + cixi, (8) 

n=2 

where we have used the fact that xq = /(O) and x„ > 0. This inequality already gives 
the upper bound Mi(ci) on Xi. To obtain the lower bound h^Ci, C2), note that the other 
extra condition on the open parameters x„, gives 

00 N 

Xn<C-J2 ^n, ViV e N. (9) 

n=N+l n=0 
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Using a similar inequality to that in Eq. [S] for the definition of /(C2) in combination 
with the condition given by Eq. [9] we obtain 

/(C2) < xo + C2X1 + clx2 + cl {C - Xo - Xi - X2) 

< /(0)(1 - cl) + Mi(ci)(c2 - cl) + X2{cl - cl) + clC. (10) 

In the second step we have employed again the fact that /(O) = xq together with the 
upper bound for Xi < ui(ci). Eq. [10] directly delivers the lower bound given by Eq. [61 

Let us now prove that both bounds converge. The unknown parameters 
exactly the Taylor expansion coefficients of the function /(c) evaluated at the point 
c = 0, i.e., 



n 
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c=0 

This means that the upper bound Mi(ci) becomes exact if one finds the appropriate 
setting to estimate the first derivative. Choosing ci = A directly gives 

lim Mi(A) = lim = /«(0) = xi. (12) 

For the lower bound /2(ci,C2) one has to perform the limit Ci ^ prior to C2 0. 
Hence, one selects the setting C2 = VA > A = ci. Using the Taylor expansion series, 

/(cO = /(A) ^/(0) + /«(0)A, (13) 
/(C2) = /(v^) ^ /(O) + /W(0)v^+ ^/(2)(0)A, (14) 

we obtain 

hm /2(A, VA) = hm |i/(2)(0) + [/(O) -C + /« 

= lf'^'\0)=X2. (15) 
This proves that also the lower bound on X2 becomes exact in the considered limit. □ 

For the further discussion we shall assume that one can always obtain the exact values 
of the probabilities Pn, hence we will ignore any finite size effects from now on. 

So far, we have analyzed the case of an ideal threshold detector. When the detector 
has some finite detection efficiency ?7det and shows some noise in the form of dark counts 
which are, to a good approximation, independent of the incoming signals, such a detector 
can be described by a beam splitter of transmittance ?7det combined with a noisy detector 
[55]. In this scenario the argumentation presented above still holds, and the detector 
decoy method can also be used in the calibrated device scenario. Note that the operator 
F^!,c{v) is now given by 

00 

i^vac(^) = (1 - e) 5^(1 - Wdet)"n„, (16) 
n=0 
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where e represents the probabihty to have a dark count. In this case, Pva^dv) has the 
form 

oo 

P..c{v) = (1 - e) 5^(1 - VVdetTPn. (17) 

n=0 

Again, if one varies t] then, from the measured data Pvaciv) together with the knowledge 
of the parameters rj, r/dct and e, the receiver can deduce mathematicalljljl the value of 
the probabilities pn- 

The results provided in this section rely on the description of the detectors given 
by Eq. [1] and Eq. [161 However, there are many different ways to model the exact 
behavior of an imperfect detector, and quite often the model is adapted to the explicit 
situation for which one wants to use the calculated data. The probability of a no click 
outcome given by Eq. [3] and Eq. [T7] describes the typical QKD situation quite accurate 
(see, e.g., Ref. [56]). Of course, whenever this situation changes the exact analysis 
need to be adapted. Nevertheless, the main idea behind the detector decoy method 
stays invariant. Via the observations on several different input distributions {p„(?7)}, 
that directly depend on the incoming photon number distribution {pn} by means of an 
explicit, known transformation rule (binomial transformation in the case of the beam 
splitter) one can obtain more information about the incoming photon statistics. 

3. Entanglement based QKD schemes with an untrusted source 

In this section we combine the detector decoy idea with the security statement for an 
entanglement based QKD scheme with an untrusted source. The schematic setup of the 
experiment is shown in Fig.[2l The source, which is assumed to be under Eve's control, is 
placed between the two receivers. In the ideal case, this source produces entangled states 
that are sent to Alice and Bob. The entanglement is contained in the polarization degree 
of freedom of the light field. This means that at least two different optical modes have to 
be considered for each side. On the receiving side, we assume that both measurement 
devices only act onto these two modes. For simplicity, we restrict ourselves to the 
familiar active polarization measurement setup, in which each party actively chooses 
the measurement basis (3. In the BB84 protocol each receiver can choose between two 
different basis, while in the 6-state protocol all three different polarization axis can be 
selected. Each measurement device consists of a polarizing beam splitter that spatially 
separates the two incoming modes according to the chosen polarization basis j3, followed 
by two threshold detectors on the two different output modes of the beam splitter. 
The analysis for other measurement devices, like for example a passive measurement 
setup is completely analogous. Entanglement based schemes constitute a very promising 
alternative to implement QKD over long distances. In fact, they hold the theoretical 

I Note that the convergence resuh given in Proposition 12.11 does not apply directly to this scenario. 
However, it is still correct if one ignores the detector efficiency part. This is the case considered in 
Sec. [31 when we analyze the security of QKD schemes. 
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distance record for a QKD scheme without quantum repeaters so far, cf. the simulation 
in Ref. [32]. This type of protocols have been successfully implemented in many different 
recent experiments (See, e.g., Ref. [571 [581 [59] references therein.), and they are a 
suitable candidate to realize earth-satellite QKD links [60]. For more details on the 
setup, or on the measurement apparatus, we refer the reader to Refs. [321 [56] . 




Figure 2. Schematic diagram of an entanglement based QKD scheme with an 
untrusted source for the case of an active choice of the measurements basis PaiPb 
respectively. 



Section 13.11 includes the security analysis for an entanglement based QKD scheme. 
We follow the security proof technique provided in Ref. [121 [131 [23] • Using this approach 
allows us to directly pinpoint the usefulness of the detector decoy method in the security 
proof. The main result of Sec. 13.1! is given by Eq. [291 which shows that the final lower 
bound on the secret key rate only depends on a few essential parameters of the system. 
Then, in Sec. 13.21 we employ the detector decoy idea to estimate these parameters for 
the active measurement scheme. Finally, Sec. 13.31 contains the simulation of a real QKD 
experiment. There, we compare the detector decoy method with other proof techniques. 



3.1. Secret key rate 

We discuss the security level in the case of collective attacks. More precisely, we assume 
that the three parties Alice, Bob and Eve share an unlimited number of copies of the 
same state |^I/)abe- Oiice Alice and Bob have received their part of the quantum state, 
they measure it to obtain information about the state pab = trs (|\l/)^gE(^l)- The 
POVMs used by Alice and Bob are denoted, respectively, as {F^"} and {F^}- They 
contain all the measurement operators that Alice and Bob perform during the protocol, 
i.e., they also include the detector decoy measurements. These additional measurements 
enable the legitimate users to estimate some of the crucial parameters of the key rate 
formula with high confidence. Let us further assume that all the measurement operators 
are invariant under a projection measurement of the total number of photons [56]. That 
is, each of the elements Fl" or Ff satisfies 

oo 

= ^n„F,n„. (18) 

n=0 

Using this assumption, one can consider a slightly different, but completely equivalent, 
scenario for the distribution of the quantum states. The new scenario has the advantage 
that it allows a direct application of a known key rate formula based on unidirectional 
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classical error correction and privacy amplification [121 [131 [23] • Proposition l3.lt however, 
holds independently of whether we restrict ourselves to unidirectional or bidirectional 
classical communication protocols in the post-processing stage. 

Proposition 3.1. Whenever Alice and Bob use photon number diagonal measurement 
devices, then the secret key rate in the following two scenarios is the same: 

(i) Eve distributes pure quantum states |^1')abe /'^^"^ ^ given set V which contains 
the purifications of the states pab = trE(|^E')ABE(^l) ^^^^ ^'^^ compatible with the 
observed measurement data. 

(a) Alice, Bob and Eve share tripartite states pabe = trR(|$)^ggp($|) G S which 
originate from a four-party state of the form 

oo 

I'^)aBER= Y1 VP^\<l^nm) aBe\^^^)r^ (19) 
n,m=0 

where 1 0nm) abe i^^presents a state that contains n photons in the mode destined to 
Alice and m photons in the mode for Bob, and where \n, m)^ denotes an inaccessible 
shield system that records the photon number information of Alice and Bob 's signals. 
The set of possible tripartite states S contains all such states for which the bipartite 
(photon-number diagonal) states Pab = trER(|$)^gp,j^($|) are compatible with the 
observations. 

Proof. We show that for any state |^)abe ^ ^ chosen from the first scenario, there is a 
particular three party state pabe G S from the second case such that Eve's position, once 
Alice and Bob have performed their measurements, is completely equivalent. The reverse 
direction of this statement holds trivially since S <ZV. Note that Eve's eavesdropping 
capabilities are completely determined by the collection of conditional states p]^ and 
their corresponding probabilities Pij, both defined via the relation 

P^jf^i = trAB {Ff" ® F/otabe) , (20) 
when Alice, Bob, and Eve share a state o"abe- Let us start with the first case, where 
o-ABE = I^)abe(^I ^ith |^)abe ^ Using Eq. [20|and Eq. [T8]we arrive at 

n,m 

= Xl^'^^^^AB {Ff- ® Ff\(f)nm)ABE{(l^nm\) ■ (21) 
n,m 

In the second line we define 11^ ® nJ^|\E')^gg = y/Pnm\4>nm) abe- compare it with the 
second scenario we select |$)aber arising from the state |^)abe ^ coherent photon 
number measurement. Its outcome is stored in the additional register system R and the 
state is given by 

I'^)aBER = 5^n^ ® d*)ABE|0)R = J2VP^\'Pnm)ABE\n.m)^. (22) 

n,m n,m 
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Using ctabe = t^R (I'^)aber('^I) ^'i- 120] directly delivers the same result as Eq. [211 
This finally proves the proposition. □ 

Next we focus on a security proof that only requires direct classical communication 
in the reconciliation part of the protocol. More precisely, we apply the secret key rate 
formula derived in the recent security proof presented in Refs. [121 [T31 [23] • It relies 
on Alice, Bob, and Eve sharing signal states of the form given by Eq. [191 Once the 
legitimate users have measured their part of pabe = trR(|$)^ggp^($|), they only have 
access to their classical outcomes which are stored in registers X and Y respectively. On 
the contrary. Eve still has at her disposal a quantum state. This scenario is described 
by the so-called ccq state pxye = A^(pabe) that results from the map 

PABE ^ PxYE = M{pabe) = ^Pij\iJ)xY{hj\ ® Pe , (23) 

where the probabilities pij and the conditional states p^ are defined like in Eq. [20l by 
setting ctabe = Pabe- According to Refs. [23], the secret key rate, that we shall denote 
as R, satisfies 

oo 

R> inf gnm.S{X\E,n,m)-gH{X\Y). (24) 

PABE 65 ■'' ' 

n,m=U 

The infimum runs over all possible tripartite states pabe that belong to the class S 
defined in Proposition 13. 1[ Here H{X\Y) stands for the conditional Shannon entropy 
of Alice's random variable X conditioned on Bob's random variable Y. This part 
accounts for the error correction step of the protocol and it is independent of the chosen 
tripartite state Pabe ^ S. In order to compute the conditional von Neumann entropies 
S{X\E,n,m) describing Eve's information about Alice's raw key, we first calculate 
the ccq states for the definite photon number states \4>nm) abe they appear in the 
decomposition pabe = J2n. jyi Pnm I (Pnm )ABEi'P'rim\ ^ 5. Let US denote these conditional 
ccq states as Pxye — ■^il^Pnm) ABEi^nml) ■ From the definition of the conditional entropy 
we obtain S{X\E,n,m) = S{p^) — Si^p^), where S{p) denotes the von Neumann 
entropy of a generic quantum state p. The remaining parameters that appear in Eq. [211 
are the overall gain g and the individual gains gnmi ^-e., the probability that Alice and 
Bob obtain an overall conclusive result when n and m photons are detected on each side 
respectively. These parameters can be written as 

Qnm Pnm^^m; (25) 

9 = X^W, (26) 

n,m 

with the conditional yields Ynm defined as the probability that both parties 
obtain a conclusive outcome conditioned on the fact that they received a state 

trE(|<^nm)ABE('^nm|)- 

The detector decoy idea does not imply any change in the underlying security 
proof. In fact, one could even improve the lower bound on the secret key rate formula 
given in Eq. [24] by including local randomization steps [T2l [T3l [611 [62] or by allowing 
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several rounds of classical bidirectional communication |23]- The main advantage of 
the detector decoy method is that it allows Alice and Bob to acquire more information 
about the class S over which they have to perform the optimization. As explained in 
the next subsection, one can in principle obtain the full statistics that PNR detectors 
could give. Note, however, that when Alice and Bob use PNR detectors they also have 
single shot resolution. Still, to have access to the statistics of the arriving signals allows 
the legitimate users to gain more knowledge about Eve's information on the raw key. 
Thus a smaller amount of privacy amplification is needed, and consequently one obtains 
more secret key. 

One can further simplify the lower bound on the secret key rate formula such that 
only a few parameters need to be estimated, cf. Ref. [23]. The conditional entropies 
satisfy H{X\n,m) > S{X\E,n,m) > for all photon numbers n and m. This means 
that the secret key rate R can always be lower bounded by restricting the sum in Eq. [21] 
to any of its items. For instance, one can select the single photon and the vacuum 
contributions only, and obtains 

oo 

R> inf gomS{X\n = 0,m)+guS{X\E,n = l,m = l) 

m=0 

~gH{X\Y). (27) 

So far we have not considered any explicit QKD scheme yet. In the following we 
restrict ourselves to the BB84 and the 6-state protocols, since they allow us to express 
both entropies by means of quantities that are directly observable. Moreover, and 
for simplicity, let us assume that the sifted key is only composed by those events for 
which Alice and Bob have used their normal detection device, i.e., all possible decoy 
outcomes are considered as inconclusive results and they are only used to estimate the 
class S. Similarly, all the no click outcomes and all detection events where Alice and 
Bob employed different basis choices are discarded as well. In the case of double clicks 
two options are possible: Either they are discarded as well, or one assigns at random 
one of the two conclusive outcomes "0" or "1" [56]. As a result, Alice and Bob are left 
with binary values whenever they consider an outcome pair as conclusive. As shown in 
Ref. [T2|[T3]. both parties can randomly flip their bit values together, which results in an 
overall symmetric error rate that gives H{X\Y) = h2{Q), where /12 denotes the binary 
entropy. Any conclusive result on Alice's side that originates from a vacuum input 
contains no information for the eavesdropper [63]. If we assume that these events are 
completely unbiased we obtain S{X\E,n = 0, m) = 1 for all m. This means that Alice 
and Bob do not need to perform any privacy amplification on all these outcomes, but 
note as well that they do not provide any key information because of the error correction 
part in the formula. The total vacuum gain is given by go = Ylmdorn- The conditional 
von Neumann entropy from the single photon contribution can always be lower bounded 
by the completely symmetric case, which gives S{X\E,n = l,m = 1) > /(Qn), where 
/ denotes a convex function that depends on the chosen protocol, and Qn represents 
the conditional single photon QBER that one observes with perfect detectors. For the 
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two considered protocols this function / takes the form[§| 



f(x) = i (28) 
^ l + /i2(x)-/i2(f)-f log2(3) 6-state. ^ ^ 



Let g^i'^ and f?™™ denote lower bounds on the single photon and vacuum gain 
respectively, while Q^i^ represents an upper bound to the maximal attainable value of 
the single photon QBER, of all states compatible with the class S. With this notation, 
the secret key rate satisfies 

R > gr + 9irfiQTn - 9h2{Q), (29) 

with the distinction between the BB84 and the 6-state protocol being only in the function 
/ given by Eq. [281 Note that the gains gu,go and g depend on the choice of which 
outcomes are considered as conclusive. This decision includes as well the overall sifting 
effect. Let q denote the probability that both parties use their normal detection device 
and they measure in the same basis. Then, using an asymmetric basis choice in the 
setup in combination with a very rarely switching to the decoy measurement, this overall 
sifting factor q can be made arbitrary close to unity [M] and thus we can drop it in the 
evaluation section. 



3.2. Detector decoy estimation 

In this section we apply the detector decoy method to the active measurement setup as 
it is used in the usual BB84 or the 6-state protocol, and we show how Alice and Bob 
can estimate the essential quantities to evaluate Eq. [291 That is, the vacuum gain go, 
the single photon gain gu and the conditional quantum bit error rate Qu from perfect 
detectors. 

The discussion starts with the typical model of an imperfect threshold detector 
which shows some noise in the form of dark counts as given by Eq. [T7] with t] = 1. 
Furthermore we require that Alice's and Bob's detectors have equal (and constant) 
detector inefficiency; otherwise this opens the possibility for powerful new eavesdropping 
attacks [651 [66] and other techniques have to be applied [671 [68]. Under this assumption 
it is a common technique to include the inefficiency of the detectors into the action 
of the quantum channel, and one performs the analysis with a threshold detector 
model of perfect efficiency. If one can prove security without knowing the exact 
detector efficiency, then one automatically also shows security with this particular extra 

§ Let us mention two important points here. Because of convexity of both functions one could 
alternatively use the actual, single photon QBER as an argument of the lower bound functions. 
This situation corresponds to the case in which one assumes the uncalibratcd device scenario for the 
evaluation of the privacy amplification part. However, if one takes into account any imperfections from 
the actual detection device, then one could even enhance the actual lower bound /. For example, if 
one considers a dark count model that randomly flips the bit value on Alice side (dark counts produce 
double clicks which are randomly assigned afterwards) this actually reduces Eve's information on the 
raw key and hence the privacy amplification part [121 IE] • Nevertheless we shall ignore this effect in 
our discussion. 
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knowledge. Suppose that both threshold detectors on each side have equal dark count 
probabilities. The POVM elements for the active measurement choice (3 are given by 



Fo = (1 - e) ^ \n, 0)^{n, 0| + e(l - e)|0, 0)(0, 0| 



n=l 



^|0,n)^(0,n|+e(l-e)|0,0)(0,0| 



(30) 



(31) 



n=l 



-^vac — Fq — Fi, with Fd denoting 
Here \n,0)g and \0,n)g refer to 



together with F^ac = (1 - ef\0, 0)(0, 0| and Fd = 1 
the operator associated with double click events, 
the corresponding two-mode Fock state in the chosen polarization basis (3. Although 
we restrict ourselves to this particular model, the analysis that follows can also be 
straightforwardly adapted for the calibrated device scenario. 

Let us begin by analyzing the single photon gain gn. Consider a simple setup where 
Alice and Bob insert only a single beam splitter in front of their measurement devices. 
This beam splitter is of course not assigned to the quantum channel. This scenario is 
illustrated in Fig[3|, where the transmittance of Alice and Bob's beam splitter is denoted 
as ?7a and ?7b respectively. This setup has the advantage that both legitimate users only 




Figure 3. Schematic diagram of the first detector decoy setup considered. Alice and 
Bob place a single beam splitter, with transmittance tja and rjB respectively, in front 
of their detection device. 



need to collect the count rates for one variable beam splitter per site, but it still enables 
Alice and Bob to obtain the overall photon number distribution pnm of the incoming 
signals. With this information they can directly compute the individual gain of the 
single photon contribution gn for the considered scenarios. For this detection device 
the overall "no click" operator on Alice's side becomes 

oo 

KUva) = {1- efY.il -VArnt (32) 

n=0 

where the projector onto the n-photon subspace is given by 

n 

= Y\k,n- k)f^{k,n- k\. (33) 

A;=0 

— * 

Note that this operator is independent of the chosen measurement basis /3, and hence 
we omit this label in the following whenever it is redundant. A similar expression holds 
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for Bob's measurement operator -F^c(^b)- Suppose that both parties receive now the 
generic input state pab? then they observe a no chck outcome with probabihty 

oo 

Pvac(^A,r7B) = (l-er (l-^Ar(l-^B)>n„^, (34) 

n,m=0 

where the photon number distribution is given by Pnm = trAB(n^ ® IIJ^pab)- 
Now, if Ahce and Bob vary the transmittance of their inserted beam sphtters, they 
can generate a whole set of hnear equations similar to those given by Eq. [3ll in which 
the photon number distribution appears as the open parameter. With this set of 
equations the whole distribution becomes accessible to Alice and Bob, however if they 
are only interested in the single photon probability pn then the three different settings 
of Proposition 12.11 are already enough. Next, let us compute the single photon gain 
Qii for two different scenarios. Whenever Alice and Bob randomly assign bit values to 
their double click outcomes any single photon state will necessarily produce a conclusive 
outcome. In the second case, we consider that only single clicks contribute to the raw 
key rate. Here the individual gain is slightly lower than in the first situation since a 
single photon can trigger a double click event because of dark counts. The two different 
individual gains are given, respectively, by 

9ii,d=Pu, (35) 
9ii,s = (1 - e)Vi, (36) 

where the subscripts "d" (with double clicks) and "s" (single clicks only) label the two 
different cases. Let us mention that the idea of obtaining the impinging photon number 
statistics with only one variable beam splitter can as well be applied to other photon 
number preserving linear networks, since the probability to obtain an overall no click 
outcome in the all the threshold detectors after such a network can always be calculated 
by replacing the whole network by only one such threshold detector. 

The vacuum gain qq represents a direct observable quantity even without the 
detector decoy method. It only relies on the fact that one can obtain the statistics 
of a perfect threshold detector from the observed data of a detector which has dark 
counts [69] • Suppose that Bob considers a specific measurement outcome k which he 
can perfectly distinguish with his measurement device, and the corresponding POVM 
element is denoted by F^. Then, the probability that Alice registers no click at all while 
Bob sees this specific outcome is given by 

Pvac,fc = (1 - e)'trAB (|0, 0)^(0, 0| ® F,%b) = (1 - e)Vok. (37) 

Since both parties can have access to the dark count probability e they can directly 
use Eq. |37] to compute the probability po,k from perfect threshold detectors. Using this 
value directly allows to infer the vacuum gain for the two different scenarios as 

r?o,d = [l-(l-£)Vd, (38) 
9o,s = 2e(l - e)|}o,s- (39) 
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The resolved single photon QBER Qn is inaccessible with the simple detector 
decoy setup presented above. We can consider a more complicated setup in which 
a variable beam splitter is place in front of each threshold detector. This scenario 
is depicted in Fig. HI Now Alice and Bob can adjust the transmittance of their two 
beam splitters tJa = (?7a,i, ''7a,2) and r/B = {vb,i,Vb,2) respectively. Although, from a 
practical point of view, this scenario is less attractive than the previous one — it requires 
a more complicated statistical analysis — it is interesting on a conceptual level since it 
can provide Alice and Bob with the same statistics like PNR detectors. Obviously all 
the results from the simple setup apply if one selects ?7a,i = f]A,2 = Va and similar for 
Bob's side. Now the POVM element for the overall no click outcome on Alice's side is 




Figure 4. Schematic diagram of tlie second scenario analyzed, where Ahcc and Bob 
place a variable beam splitter in front of every threshold detector. 

given by 

KUAVa) = (1 - Yl nlA\k, l)p,{k, II (40) 

fc,/=0 

where we use the abbreviation f] = 1 — rj. A similar expression can be obtained for 
F^^^j^(f/B)- In contrast to the first measurement device analyzed, now the no click 
outcome depends on the chosen polarization basis /3 = (/3a, /3b). The probability of the 
combined "no click" outcome in Alice's and Bob's side can be written as 

oo 

^'vac./^A, ^b) = (1 - e)' Yl ^i,l^i,2^B,l^B,2 ?/|(^, ^5 ^, *), (41) 

k,l,r,s=0 

where the probabilities q0{k, I; r, s) have the form 

q0{k,l;r,s) = trAB (\k,l)pjkj\ <S> \r, s) f^^{r, s\ pab) • (42) 

These probabilities coincide with the ones provided by PNR detectors. Using again the 
idea of different settings for the transmittance of the adjustable beam splitters one can 
generate more linear equations of the form given by Eq. HH Consequently, the photon 
number resolved statistics q0{k,l,r, s) become accessible to Alice and Bob. With this 
resolved distribution at hand it is straightforward to compute the single photon QBER 
Q^ii that Alice and Bob would observe using perfect detectors. It is determined by 

= ^^^^ 0; 0' 1) + 9/3(0' 1; 1' 0)- (43) 

Note that one has to use the symmetrized single photon QBER in the lower bound 
formula given by Eq. [291 
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3.3. Evaluation 

In this part we evaluate the lower bound on the secret key rate for the different decoy 
detection schemes presented in the last subsection. Additionally, we compare it with a 
security proof that relies on the validity of the squash model; for a different comparison 
between the squash model and an alternative estimation procedure not based in this 
last paradigm see also Ref . [70] . We assume that all relevant parameters that appear in 
the lower bound formula can be estimated precisely, i.e., we ignore any statistical effect 
of an estimation procedure that uses only a few number of decoy settings. 

Suppose that the observed data originate from a pumped type-II down conversion 
source. The states emitted by this type of source can be written as [71] 

oo 

|^'sourcc)AB = Y] V^I'^-)aB> (44) 



n=0 

where the probability distribution p„ is given by 

in + l)X'' ,,,, 

= (TTa)^- ^''^ 

The parameter A is related with the pump amplitude of the laser and determines the 
mean photon pair number per pulse as /x = 2A. Each signal state |$n)AB contains 
exactly 2n photons; n of them travel to Alice and the other n to Bob. These states are 
of the form 

l'^n)AB = y] / — — \n-m,m)^\m,n-m)^, (46) 

where we have used the standard basis on each side, i.e., Pa = Pb = ^- When n = 1, the 
signal state in Eq. |16] becomes the EPR state, which admits perfect anticorrelations in 
all direction^. When n >2, the states represent VT-states. That is, even if Alice 

and Bob measure them along the same direction they might observe double clicks. In 
fact, the biggest contribution in the observed QBER stems from the multiphoton pairs. 
For instance, if the signal |$n=2) loses only one photon in the channel, then the error rate 
of the resulting state (although still entangled) is already aboul0 16.6%. This QBER 
is above the threshold error rate allowed by the one-way security proof employed in the 
previous section, even assuming a single qubit realization. This means, in particular, 
that the expected average mean photon number A which optimizes the secret key rate 
in the long distance limit is quite low, and one does not expect a security proof which 
enables to drive the source with a much higher mean photon number. 

To generate the observed data of an experiment that uses this kind of source we 
employ the following procedure: Since the loss is the predominant factor in the error 
rate and in the overall gain, we assume that the state emitted by the source passes first 

II If Alice and Bob employ the measurement devices from Eqs. 1301 1311 then they would always observe 
anticorrelated outcomes. Hence, one of the parties has to interchange the observed data "0" "1". 
% Note, however, that there are different, more complicated measurement techniques that can be more 
robust against particle loss from a PDC source [72] , 
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through a lossy, but otherwise error-free channeL Such a channel is characterized by the 
loss coefficient a and the total distance /. We include as well in the channel the effect of 
the detector efficiency r/det of the measurement device. Hence, the overall transmission 
in the optical line towards Alice becomes 



and determines the overall loss coefficient dbA- A similar relation holds also for 
the channel towards Bob. The total loss between both parties is characterized by 
dbtot = dbA + dbe. After the lossy channel, we include the effect of the misalignment 
and the dark counts of the detectors in the observed data. The misalignment varies 
slightly the polarization of the incoming light field. This effect changes over time and 
it is assumed to be uncontrollable. Averaging it results in an action similar to that 
of a depolarizing channel. Specifically, we consider the following misalignment model: 
Every time a single photon arrives at the detection device it triggers the correct detector 
with probability (1 — e), while with probability e it changes its polarization and triggers 
the wrong detector. When more photons enter the detection apparatus this effect is 
assumed to occur independently for every single photon and hence it can also change 
the probability to observe a double click. To conclude, we assume as well that Alice's and 
Bob's detectors suffer from dark counts as described in the previous subsection. Dark 
counts are typically the crucial parameter that limit the distance of a QKD scheme. 

Next, we compare the different lower bounds on the secret key rate for the various 
scenarios considered, which again are distinguished by the subscripts "s" and "d" 
depending on the double click choice. In the simple detector decoy setup the resolved 
error rate is not directly accessible. Still, one can upper bound it via a worst case 
assumption. That is, we consider that all errors originate from the single photons only. 
In the single click case this upper bound, denoted as Qn ^, is given b}Q 



A similar relation gives the upper bound Qn d fo^' the double click case. On the other 
hand, in the detector decoy scheme which has two variable beam splitters in each side the 
conditional quantum bit error rate Qu is equal to the hypothetical QBER arising with 
perfect detectors, independently of the chosen scenario. The different lower bounds are 
illustrated in Tab. [1] This table also includes the case where both parties employ perfect 
PNR detectors. This type of detectors allows them to condition the error correction on 
the photon number observed. This way, the term H{X\Y) which appears in Eq. [241 can 
be changed by the conditional term ^ gnmH{X\Y, n, m). The lower bound contained in 
Tab. [1] corresponds to the case where single click events are the only conclusive outcomes. 
A fair comparison with a security proof based on the squash model is only possible if 
one employs the result from Refs. [331 to further extend the validity of the squash 

+ From this estimation one could even try to calculate out the dark count probability of the detectors. 
However, we shall ignore this effect here. 




(47) 




(48) 
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Scenario 


Lower bound 


Updated Squash 


5'o + - n2{Q\\)\ - gdh2{Qd) 


Double 


904 + fi'ii,d/(Qii) - gdh2{Qd) 


Double + Bound 


go,d + 5'ii,d/(<5ii,d) - 9dh2{Qd) 


Single 


go,s + gu,sfiQu) - gsh2iQs) 


Single + Bound 


go,s + ^ii,s/(<5ii,s) - gMiQs) 


PNR 


Pii[/(Qii)-/^2(gii)] 



Table 1. Different lower bounds on the secret key rate for the various scenarios 
considered with active basis choice measurements. 

model to the situation where Alice's and Bob's detectors have dark counts; otherwise 
one loses the vacuum gain. The exact target measurements are given by Eqs. [301131] with 
n = 1 and where every double click is randomly assigned to one bit value. As a result, 
we obtain the lower bound formula given in Tab. [H ( "Updated squash") in which go and 
gii denote, respectively, the squashed vacuum gain and the corresponding single photon 
gain, while Qn stands for the conditional QBER on the squashed single photons. Since 
the squash model does not exist for the active 6-state protocol [31], here one cannot 
choose the function /. 

For the simulation we consider an asymmetric distance scenario, since this situation 
optimizes the gain of the detector decoy idea over a security proof that relies on the 
squash model. In particular, we assume that Bob is much closer to the source than 
Alice. Such a situation might appear often in a QKD network, where certain users 
can be further away from the relay stations than others. The results for the BB84 and 
the 6-state protocol are shown, respectively, in Fig. [5] and in Fig. [61 The first case 
always corresponds to the situation where Alice and Bob place a single beam splitter in 
front of their detection device, while the second case represents the scenario where the 
legitimate users place a variable beam splitter in front of every threshold detector. The 
position of the source is denoted by a black square and is kept constant at a dbe = 3 
loss distance, so we only increase the distance towards Alice. For each lower bound we 
perform an optimization over the free parameter A that corresponds to the mean photon 
pair number. 

It is worth mentioning that the squash model delivers a higher lower bound on the 
secret key rate than that corresponding to the detector decoy method in the double 
click case. This seems surprising at first since the detector decoy idea provides the 

* AU formulae in Tab. [1] are for active basis choice measurements. In particular in a passive basis 
choice selection the results of the squash model change. One could at least discard double or multiclick 
events between different basis outcomes, and moreover a squash model exists for the passive 6-state 
protocol. 
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Figure 5. Different lower bounds on the secret key rate for the simple decoy detection 
setup shown in Fig. [3] with e = 10~^ and e = 0.03. The inset figure shows the value 
for the optimized parameter A of the source. 



exact knowledge of all important single photon parameters. Note, however, that in 
the discussion which leaded to the lower bound formula given by Eq. [27| we restricted 
ourselves to only draw a secret key from the single photon contribution. In contrast, the 
squash model does not necessarily constrain the parties to obtain a secret key from the 
single photon contribution only, but instead attempts to even draw a secret key from the 
multiphoton events. In this sense, one can consider the squash model as a "calculation 
method" that allows to lower bound the amount of privacy amplification necessary for 
the multiphoton events by an equal amount of privacy amplification "calculated" on a 
hypothetical single photon state. Hence using the squash model directly lower bounds 
the key rate from Eq. [211 On the contrary, the detector decoy idea provides a slightly 
higher secret key rate than the squash model when Alice and Bob discard their double 
click events. Note that this action is not possible with the squash model assumption. 
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Figure 6. Different lower bounds on the secret key rate for the refined decoy detection 
setup shown in Fig. 2] with e = 10~^ and e = 0.03. The inset figure shows the value 
for the optimized parameter A of the source. 

For the asymmetric distance scenario, this fact allows the two parties to drive the source 
with a slightly higher mean photon number, since the double clicks that occur frequently 
on the side closer to the source can be discarded from the error rate. See inset plots 
of the optimized mean photon number in Figs. [5l [61 In the squash model one has to 
keep the double click rate low on both sides, because the penalty in the error rate for 
each double clicks is 50%. Therefore, one has to use a lower mean photon number. 
This effect decreases with the distance, and in the long distance limit this advantage 
vanishes. Moreover, note that by adding the vacuum gain in the lower bound formula 
the resulting maximal achievable distance is shifted by around db = 10. 

We have shown that the detector decoy idea provides a simple method to adapt a 
single photon security proof to its full optical implementation, while still providing 
similar key rates as those arising from a security proof using the squash model 
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assumption. Its main advantage relies on the fact that it can be straightforwardly 
applied also to QKD protocols, like the active 6-state protocol, where the squash model, 
the other "adaption technique" , does not work. 

4. "Plug & Play" configuration 

The main feature of the Plug & Play configuration for QKD is that it is intrinsically 
stable and polarization independent [THHSlIll]. Apart from synchronization between 
Alice and Bob, no further adjustments are necessary. This fact renders this proposal a 
promising approach for commercial QKD systems. 

Specifically, in this type of QKD schemes Bob sends to Alice a train of bright laser 
pulses through the quantum channel. On the receiving side, Alice first attenuates the 
incoming signals to a suitable weak intensity. Afterwards, she codes the secret key 
information using phase coding, and sends the resulting weak pulses back to Bob, who 
detects them. The main idea behind this bi-directional quantum communication design 
is that now the interferometers used in a practical implementation of the scheme are 
self-stabilized because the light passes through them twice. Moreover, if the reflection 
on Alices side is done by means of a Faraday mirror, then the polarization effects of the 
quantum channel can also be compensated. 

A full security proof of a Plug & Play system has recently been given in Ref. |73j . 
However, the security analysis contained in Ref. [73] is based on a slightly modification 
of the hardware included in the original Plug & Play proposal. In particular, Alice 
performs three measures that enhance the security of the protocol and also simplify 
its investigation [731 HI]- First, she blocks any undesired optical mode by means of 
an optical filter. Then, she performs active phase randomization. This last action 
transforms the incoming signals into a classical mixture of Fock states. Finally, she 
measures the photon number distribution of the pulses received in order to estimate 
some bounds on the photon number statistics of the output signals. This can be done by 
randomly sampling the incoming pulses with an optical switch followed by an intensity 
monitor (Case A in Fig. [7]). The beam splitter that appears in this figure is used to 
implement the decoy state method which improves the whole performance of the scheme. 
More recently, a similar proposal has also been analyzed [75]. Basically, it substitutes 
the optical switch with a passive beam splitter (Case B in Fig. [7j). 

In this section, we present very briefly an alternative experimental technique to 
estimate the photon number statistics of the output signals. It is based on the 
detector decoy idea presented in Sec. [2l Moreover, it allows Alice to perform the 
decoy state method simultaneously, i.e., without using an additional variable beam 
splitter. The scheme is illustrated in Fig. [7] as Case C. It consists on a balanced Mach- 
Zehnder interferometer combined with a threshold detector. After the active phase 
randomization step performed by Alice, the signal states entering the interferometer are 
given by Eq. [2l Now, the probability that the threshold detector does not click is given 
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Figure 7. Case A) Schematic diagram of the detection setup employed by Alice 
to estimate the photon number statistics of the output signals. The variable beam 
splitter which appears in the figure implements the decoy state method |73j . Case 

B) Illustration of a more recent experimental proposal to achieve the same goal j75j . 
It uses a passive beam splitter together with an intensity monitor. Like before, the 
second beam splitter in the figure is used to realize the decoy state method. Case 

C) Alternative method based on one balanced Mach-Zehnder interferometer combined 
with a threshold detector. PM denotes a phase modulator, M represents a mirror, and 
I vac) is a vacuum state. 



by 

00 

Pvac(<^) = 

n=0 

where cp represents the phase imprinted by the phase modulator of the interferometer. 
Like before, if Ahce varies, independently and at random for each signal, the phase (p 
of her setup, then, from the observed probabilities Pvac(v'), together with the knowledge 
of the parameters [(1 — cosip)/2]^, she can estimate the photon number distribution pn 
with high confidence. Given that the probabilities p„ are now known, Alice can also 
estimate the photon number statistics g„ of the output signals. These probabilities are 
given by 

<ln = Yl u""' „ ^(l-cos^)-(l + cos^)— ■ (50) 
^-^ nlin — my. 2^ 

m=n ^ ' 

Note that by varying the phase 79 of her interferometer Alice also modifies simultaneously 
the photon number probabilities g„ of the output signals, as required in the decoy state 
method, without the need of an additional beam splitter to perform this task. 

5. Conclusion and outlook 



cosy? 



Vn-, 



(49) 



In this paper we have analyzed a simple technique which allows the direct application of 
a single photon security proof for quantum key distribution (QKD) to its physical, full 
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optical implementation. This so-called detector decoy method is conceptually different 
to that of the squash model, the other adaptation mechanism. It is based on an 
estimation procedure for the photon number distribution of the incoming light field 
that uses only a simple threshold detector in combination with a variable attenuator. 
The detector decoy method is similar in spirit to that of the usual decoy state technique: 
Since the eavesdropper does not know the particular detection efficiency setting used 
to measure the signals, any eavesdropping attempt must leave the expected photon 
number distribution unchanged (similar to the conditional channel losses in the decoy 
state technique). 

Specifically, we have investigated an entanglement based QKD scheme with an 
untrusted source where Alice and Bob actively choose the measurement basis of either 
the BB84 or the 6-state protocol. The security of both schemes is proven solely by 
means of the detector decoy method and without the need of a squash model, which 
would have to be proven to be correct for each measurement device anew. Besides, 
and opposite to the squash model paradigm, the detector decoy technique allows the 
legitimate users to discard double click events from the raw key data. As a result, it 
turns out that the secret key rates in the infinite (or sufficiently large) key rate limit 
of a BB84 simulated experiment are comparable with each other for both alternatives. 
However, the detector decoy idea offers a slightly better performance in those scenarios 
where there exists no squash model, like in the 6-state protocol. In any real-life QKD 
experiment much more obstacles have to be taken care of and thus the situation can 
change quite drastically, mainly because of finite size effects. Nevertheless, for the 
current increasing interest in examining the finite size behavior of different protocols, 
it can only be of advantage to have a broader spectrum of different proof techniques 
available, even if they all show a similar behavior in the asymptotic key rate limit. 
Finally, as another potential application of the detector decoy method in QKD, we have 
briefly described an experimental procedure to estimate the photon number statistics of 
the output signals in a "Plug & Play" QKD configuration. We believe there might be 
many other potential applications of this method in QKD, like for instance in Ref. |67j . 
In addition, it could also be used to estimate the single photon contribution in the two 
state protocol with a strong reference pulse [76l l42] . 

To conclude, let us mention that there might be scenarios where it is not really 
necessary to insert and vary the transmittance of an additional beam splitter in 
the measurement device. For instance, let us consider the efficient, passive BB84 
measurement setup, in which a beam splitter of high transmittance 77 = 1 — A splits the 
incoming light in favor of one basis versus the other. With this measurement apparatus, 
one can obtain directly three different beam splitter settings to apply the detector decoy 
formalism: Using the overall "no click" outcome of all detectors gives r/i = 1, whereas 
if one ignores all the outcomes of only one basis and looks at the no click outcomes 
in the other basis, then one obtains two more settings, 772 = 1 — A and 773 = A. 
Although these three settings are different from the ones given in Proposition 12.11 they 
can still provide good estimations of the single photon contribution. Moreover, the 
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method could be improved even further. After all, in showing security we have not used 
all available information from our measurement results, as the further occurrences of 
double or multiclicks in our detection devices has been ignored. The use of this extra 
knowledge can only enhance the estimation procedure and thus can further reduce the 
number of necessary detector decoy settings. In fact, it is possible to provide a BB84 
security proof by just using an estimation technique [70]. It might be interesting to 
compare the detector decoy idea with the results presented in Ref. [70], and we leave 
these open questions for further analysis. 
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